How severe is CVE-2025-5241?

CVE-2025-5241 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2025-5241 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (29th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2025-5241?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-5241 have an EU (EUVD) identifier?

Yes. CVE-2025-5241 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-21089.

When was CVE-2025-5241 published?

CVE-2025-5241 was published on 2025-07-11 and last updated on 2026-06-17.

CVE-2025-5241

CVE-2025-5241 is a medium-severity vulnerability with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-645.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (29th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-21089
Weakness: CWE-645
Published: 2025-07-11
Last modified: 2026-06-17

Description

Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwords. The legitimate users will be unable to login until a certain period has passed after the lockout or until the product is reset.

Frequently asked questions

What is CVE-2025-5241?: Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwords. The legitimate users will be unable to login until a certain period has passed after the lockout or until the product is reset.
How severe is CVE-2025-5241?: CVE-2025-5241 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2025-5241 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (29th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-5241?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-5241 have an EU (EUVD) identifier?: Yes. CVE-2025-5241 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-21089.
When was CVE-2025-5241 published?: CVE-2025-5241 was published on 2025-07-11 and last updated on 2026-06-17.

References

Other CWE-645 vulnerabilities

CVE-2023-4346 — High (CVSS 7.5): KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable…
CVE-2026-53982 — Medium (CVSS 6.5): Cap-go Console < 12.28.2 contains a denial-of-service vulnerability in its account deletion flow that allows an…
CVE-2025-31947 — Medium (CVSS 5.8): Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users…
CVE-2026-25907 — Medium (CVSS 5.3): Dell PowerScale OneFS, version 9.13.0.0, contains an overly restrictive account lockout mechanism vulnerability. An…
CVE-2024-1722 — Low (CVSS 3.7): A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block…

Browse all CWE-645 vulnerabilities →